BrevFeed
Sign in
← All stories
● Covered by 1 source · 1 reportMedium impact1 neutral

Two Critical Flaws in MarkLogic Server Allow Privilege Escalation to Admin Control

🔄 Updated 25d ago
Aggregated by BrevFeed security · updated 25d ago
🔖 Save
New to BrevFeed? We gather this story from every outlet covering it into one summary — ranked by real-world impact, not just the latest headline — so you never miss what matters. What is BrevFeed? →

Key points

  • 31 new flaws disclosed in MarkLogic Server.
  • Two critical flaws allow privilege escalation to admin control.
  • Fixes available in MarkLogic 11.3.7 and 12.1.0 since September 10.
  • No known exploits in the wild as of October 13.

Critical Vulnerabilities Disclosed

Progress Software has revealed 31 new vulnerabilities affecting its MarkLogic Server database. Among these, two critical flaws could enable an account with limited management privileges to escalate to full administrator control of the server. These vulnerabilities were publicly disclosed on October 12, with fixes released on September 10.

Affected Versions and Patches

The critical flaws impact MarkLogic 11.x versions prior to 11.3.7 and MarkLogic 12.x versions prior to 12.1.0. Users of MarkLogic 11.x should upgrade to 11.3.7, while MarkLogic 12.x users need to upgrade to 12.1.0. Previous fixes for 10 MarkLogic flaws released in August (in versions 11.3.6 and 12.0.3) do not address these new vulnerabilities.

Details of Critical Flaws

Progress scored three of the five critical flaws at 9.9 out of 10 on the CVSS scale, and the other two at 9.6. Exploitation of these flaws requires the attacker to already possess certain privileges or the ability to execute code on the server. Two specific flaws, CVE-2026-85947 and CVE-2026-85948, relate to how 'forest-scoped administrative grants' can be misused to attach forests to databases, allowing unauthorized control. There are no known workarounds for customers unable to upgrade immediately.

No Evidence of Exploitation

As of October 13, none of the 31 newly disclosed flaws have been observed in active attacks, nor are they listed in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog. Four of the five critical flaws were reported by external researchers through Bugcrowd.

✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →

Keep reading

security Adobe Patches Critical ColdFusion and Campaign Classic Vulnerabilities Amid Exploits 14h ago security CISA Alerts on Active Exploitation of Multiple Microsoft SharePoint Vulnerabilities 1d ago security Chrome 150 Update Addresses 27 Vulnerabilities, Enhances Security 3d ago security PHP warns of two critical RCE flaws, emergency patches due October 21 3d ago security Researchers Reveal Security Flaws in AI Coding Agents and Open-Source Mobile Frameworks 1d ago

The daily brief

One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.

One email a day. Unsubscribe in one click, any time.

Today's brief

Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.

~4 min · 3 stories · Nov 07

▶ Play today's brief Listen on Spotify

New every morning, and the back catalogue is archived by date.

Primary sources

CVE CVE-2026-859479.9 CRITICAL CVE CVE-2026-859489.9 CRITICAL CVE CVE-2026-859559.9 CRITICAL CVE CVE-2026-859569.6 CRITICAL CVE CVE-2026-91919.6 CRITICAL CVE CVE-2026-859548.6 HIGH

Reporting from

The Hacker News — Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control 25d ago →

Progress Software disclosed 31 new flaws in its MarkLogic Server database, including two critical vulnerabilities that allow delegated managers to gain full administrator control. Fixes are available in MarkLogic 11.3.7 and 12.1.0, and users of affected versions should upgrade immediately.